CVE-2021-27419

Name	CVE-2021-27419
Description	uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1010748

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
uclibc (PTS)	jessie	0.9.32-1	vulnerable
	stretch	1.0.20-2	vulnerable
	buster	1.0.31-1	vulnerable
	sid, bullseye, trixie, bookworm	1.0.35-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
uclibc	source	(unstable)	(unfixed)	unimportant		1010748

Notes

https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
https://github.com/wbx-github/uclibc-ng/commit/015d5b8c1a75b551f7f0215543fac01d55abfc0f (v1.0.37)